CVE-2025-21683 bpf: Fix bpf_sk_select_reuseport() memory leak
A memory leak in the Linux kernel's BPF subsystem allows local attackers to exhaust system memory, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21683?
CVE-2025-21683 is a medium-severity memory corruption vulnerability in Linux kernel, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix bpf_sk_select_reuseport() memory leak
As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF set before it was ESTABLISHED. In other words, a non-NULL sk_reuseport_cb does not imply a non-refcounted socket.
Drop sk's reference in both error paths.
unreferenced object 0xffff888101911800 (size 2048): comm "test_progs", pid 44109, jiffies 4297131437 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 80 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9336483b): __kmalloc_noprof+0x3bf/0x560 __reuseport_alloc+0x1d/0x40 reuseport_alloc+0xca/0x150 reuseport_attach_prog+0x87/0x140 sk_reuseport_attach_bpf+0xc8/0x100 sk_setsockopt+0x1181/0x1990 do_sock_setsockopt+0x12b/0x160 __sys_setsockopt+0x7b/0xc0 __x64_sys_setsockopt+0x1b/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Weakness: CWE-401
Which versions are affected by CVE-2025-21683?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21683?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-21683 being exploited?
There is no known exploitation of CVE-2025-21683 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56268, AZL-56333, BELL-CVE-2025-21683, DEBIAN-CVE-2025-21683, GHSA-fjfj-r96f-8hqw, UBUNTU-CVE-2025-21683.